Activity for GIFLIB
-
Michael Cirioli posted a comment on ticket #198
Attached patch fixes the double-free in EGifPutScreenDesc (SF bug #198) while preserving the fix for the EGifSpew leak (SF bug #165). In EGifPutScreenDesc, the pointer-reuse branch added in commit 53d5fcd caused EGifCloseFile to free caller-owned colormaps when passed by reference or assigned to GifFile->SColorMap. The patch: 1. Restores EGifPutScreenDesc to always allocate its own copy of ColorMap via GifMakeMapObject, leaving caller ownership untouched. 2. Handles the EGifSpew cleanup directly...
-
Adrian Martinez created ticket #210
Double-free in GifMakeSavedImage (sibling of CVE-2026-23868)
-
Mohmamed Mohamed Elnady modified a comment on ticket #209
Correction — please use these attachments instead of the earlier 0004–0006. The previously attached patches contained leftover merge-conflict markers in the gifalloc hunks — a commit-tooling error on my side, caught during follow-up work. The corrected series (6 patches, all final-state, no fixup-on-fixup) supersedes them: 0004 (attached): gifalloc memory-safety hardening as one commit with all four fixes and full evidence: (1) stale ImageCount after GifFreeSavedImages() → OOB write in GifMakeSavedImage();...
-
Revised attachments (same numbers, updated contents) — posted before you spend time on the originals: • 0008 (tests): as originally written it depended on fixes from the other tickets I'm filing — applied standalone with only this ticket's patches, the quantize/encoder checks would fail and the NULL-callback checks would crash the test binary on unpatched constructors. Trimmed to this ticket's scope (8 checks); the other tickets carry their own test commits (0009/0010/0011), so make check stays green...
-
GifMakeSavedImage: stale ImageCount use-after-free and OOB write in the free/append lifecycle; self-aliased copy UAF; NULL-handling hardening
-
Jeff Bindel created merge request #28 on Code
decode: add optional -fbounds-safety annotation for ExtensionBlock.Bytes
-
Sujal Tuladhar created ticket #207
gifclrmp -t inverts the translation index at gifclrmp.c:392, producing wrong colours and a heap out-of-bounds write
-
Darren Carreras created merge request #27 on Code
Fix same-file GifMakeSavedImage copies
-
manan sanghvi created merge request #26 on Code
Harden GIF decoding with a memory-safe Rust LZW core
-
Trithem created merge request #25 on Code
Validate decoded GIF color indexes against active color tables
-
Nexory created ticket #205
EGifPutImageDesc: unreachable guard, and writes whose result is discarded
-
Max van Amersfort created merge request #24 on Code
Enforce GIF color-map invariants
-
Preserve extensions in GifMakeSavedImage copies
-
Marc Deslauriers created ticket #38
ExtensionBlockCount is never updated
-
NGUYEN HOANG HAI created ticket #204
Fix integer overflow and (unsigned int) truncation in gif2rgb.c
-
Andrew Hughes created merge request #22 on Code
Declare correct_saved_images at start of block
-
Eric S. Raymond committed [a8e311] on Code
NEWS update.
-
Buffer Overflow vulnerability in giflib
-
Fix applied and pushed
-
Resolve ticket #203: GifUnionColorMap NULL Pointer Dereference
-
Fix integer overflow and type safety issues across giflib
-
Fix CVE-2026-26740: heap OOB write in EGifGCBToSavedExtension
-
sidhartha kumar posted a comment on ticket #202
I have successfully created a patch and submitted a Merge Request for this issue here: https://sourceforge.net/p/giflib/code/merge-requests/21/ The patch adds an input validation check at the top of GifQuantizeBuffer() that rejects zero dimensions and dimension pairs whose product would overflow INT_MAX, preventing the heap OOB write.
-
Fix integer overflow in GifQuantizeBuffer (CWE-190 → CWE-787)
-
Michal Hlavinka posted a comment on ticket #201
This bug report is a duplicate of bug #199 As for the patch, I'm not really sure that silently resizing the buffer is the best approach. It does not match DGifExtensionToGCB which refuses the image and returns error. I think that doing the same - just returning error for invalid data would be better solution.
-
added the patch.diff attachment couldn't more than one attachment at a time
-
Heap buffer overflow in GifQuantizeBuffer via integer overflow
-
Naveed Khan created ticket #201
Heap buffer overflow in EGifGCBToSavedExtension on malformed Graphics Control Extension
-
Howetuft modified a comment on discussion Open Discussion
<removed></removed>
-
Hello, First, thank you very much for making this lib available to all in open source. However, could you please refrain from frequently changing the structure of the directories where you store sources? Like many developers, I get your sources via a package manager (conan, but could be vcpkg, chocolatey etc. as well) and your changes in the tree constantly break the build recipes.... You did it several times since the beginning of the year, and each time it implies some effort to rebuild the recipes,...
-
I can confirm that with provided poc.gif the problem can be reproduced by running giftool with valgrind: ==56559== Invalid write of size 1 ==56559== at 0x488933B: EGifGCBToExtension (in /usr/lib64/libgif.so.7.1.0) ==56559== by 0x488D93A: EGifGCBToSavedExtension (in /usr/lib64/libgif.so.7.1.0) ==56559== by 0x4000F03: ??? (in /usr/bin/giftool) ==56559== by 0x48985B4: (below main) (libc_start_call_main.h:58) ... I've added a fix to my build - same check as is in the reverse function DGifExtensionToGCB...
-
Gayathri Venkat created ticket #199
Buffer Overflow vulnerability in giflib
-
Scott Kidder created ticket #198
EGifPutScreenDesc pointer-reuse optimization causes double-free
-
GIFLIB released /giflib-6.x/giflib-6.1.3.tar.gz
-
Ready to ship 6.1.3
-
Prepare for release.
-
No, the real problem is you have a crappy single-pass linker. The library builds just fine on systems without broken toolchains.
-
No, the real problem is you have a crappy single-pass linker. The library builds just fine on systems without brokenm toolchains.
-
Avoid a dodgy edge case in reallocarry().
-
Global-buffer-overflow (OOB read) in GifDrawText8x8
-
I've added full bounds checking and clipping on all entry points in gif_font.c
-
Heap-buffer-overflow (OOB write) in GifDrawText8x8
-
I've added full bounds checking and clipping on all entry points in gif_font.c
-
Heap-buffer-overflow (OOB write) in GifDrawRectangle
-
I've added full bounds checking and clipping on all entry points in gif_font.c
-
heap-buffer-overflow (OOB write) in GifDrawBox
-
I've added full bounds checking and clipping on all entrry points in gif_font.c
-
Add full bounds-checking and clipping on all gif_font.c operations.
-
Address GifLib bug #192: Heap buffer overflow in GifUnionColorMap...
-
missing 6.1.1 tarball
-
Not that I know of. But this is only going to happen on majorversion bumps, and there have only been three of those in 40 years.
-
Fix integer overflows, out-of-bounds access, and uninitialized memory
-
Fix integer overflows, out-of-bounds access, and uninitialized memory
-
This is not a patch for giflib. Can't apply, rejected.
-
Not that I know of. But this is only going to happwn of majoe version bumps, and there have only been three of those in 40 years.
-
Mohammad Seet created ticket #37
Comprehensive integer overflow prevention and security hardening
-
Biniam D created ticket #197
Global-buffer-overflow (OOB read) in GifDrawText8x8
-
Heap-buffer-overflow (OOB write) in GifDrawText8x8
-
Heap-buffer-overflow (OOB write) in GifDrawRectangle
-
heap-buffer-overflow (OOB write) in GifDrawBox
-
joborun linux modified a comment on discussion Help
make install does not include the gif2rgb for bin doc man as it used to although the files are built I had to manually add them
-
make install does not include the gif2rgb for bin doc man as it used to although the files are built I had to manually add them
-
Ildar Mulyukov posted a comment on ticket #191
the patch is very strange. Could you please clarify how is it supposed to be applied? Note: it patches files like vp8/encoder/onyx_if.c
-
Michael Cho posted a comment on ticket #189
As another data point, in Homebrew we also saw undefined symbols error in 6.1.2 release. This is specific to macOS builds and can be reproduced with a make all in a fresh download of release tarball. Or isolated to specific problem target via make libutil.dylib, e.g. ❯ curl https://downloads.sourceforge.net/project/giflib/giflib-6.x/giflib-6.1.2.tar.gz -sL | tar x ❯ make -C giflib-6.1.2 libutil.dylib cc -std=gnu99 -fPIC -Wall -O2 -c -o qprintf.o qprintf.c cc -std=gnu99 -fPIC -Wall -O2 -c -o getarg.o...
-
pandablackhole created ticket #191
Fix integer overflows, out-of-bounds access, and uninitialized memory
-
Dominic Lüchinger posted a comment on ticket #190
Our build system relies on conan downloading the giflib dependency from https://downloads.sourceforge.net/project/giflib/giflib-5.2.1.tar.gz It seems the file where moved and now the conan https://github.com/conan-io/conan-center-index/blob/29a66c9c0d881651cab2573a4e63ad6e57cddc7f/recipes/giflib/5.2.x/conandata.yml points to the wrong location. Maybe other package managers or other build system might have similar issue. Is there a way to instruct sourceforge that the location was moved and will do...
-
Thomas Klausner posted a comment on ticket #190
Thanks, looks good now!
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
I fixed my release machinery. You'll find giflib-6.1.2 in the giflib-6.x repository on SourceForge.
-
-
Ready to ship 6.1.2
1 >
